Vulnpedia
← All CVEs

CVE-2026-11824

HIGH 8.5 ALL-YEARS

Published 2026-06-09 · Last modified 2026-10-15 · VulnCheck · NVD: Modified

SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.

ELEVATED IMPACT

Severe if exploited (CVSS 8.5), but no confirmed exploitation. Patch on a normal cadence.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 8th percentile

○ In CISA KEV○ Catalogued PoC◆ SSVC: exploitation none, automatable no

Impact if exploited

8.5CVSS 4.0 · HIGH · CNA

  • ConfidentialityHigh
  • IntegrityHigh
  • AvailabilityHigh

What an attacker needs

  • ⚠Access: Requires local access to the host
  • ✓Privileges: No account or privileges required
  • ⚠User interaction: Succeeds with passive user activity
  • ✓Complexity: No special conditions — reliably repeatable
  • ✓Requirements: No special attack requirements

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked weekly for the full archive, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Affected

Vendors Sqlite Siemens

Products Sqlite Ruggedcom Crossbow Station Access Controller (Sac)

Weakness (CWE)

  • CWE-122: Heap-based Buffer Overflow

CVSS vector

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References and research data (JSON)

Vendor product assessments

Showing 32 of 2026 vendor product statements; 1994 omitted. Read the full vendor advisory.

  • rhcos-x86_64-412.86.202609082051-0 as a component of Red Hat OpenShift Container Platform 4.12 · fixed

    Vendor assessment for this product only.

    pkg:generic/redhat/[email protected]?arch=x86_64

    • vendor fix: For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes You may download the oc tool and use it to inspect release image metadata for x86_64 architecture. The image digest may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha value for the release is as follows: (For x86_64 architecture) The image digest is sha256:0ba3b9ea13531f643027339fef1e1a1e04bd4d87f3387f25e6d7e3dfa64bad52 All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html-single/updating_clusters/index#updating-cluster-within-minor. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • nodejs-devel-1:24.18.0-3.module+el8.10.0+24639+56878497.ppc64le (nodejs:24) as a component of Red Hat Enterprise Linux AppStream (v. 8) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]%2Bel8.10.0%2B24639%2B56878497?arch=ppc64le&epoch=1&rpmmod=nodejs:24:8100020260807112957:6d880403

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • sqlite-debuginfo-0:3.34.1-6.el9_2.3.i686 as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.3?arch=i686

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • sqlite-devel-0:3.34.1-8.el9_6.1.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_6.1?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • sqlite-tcl-debuginfo-0:3.34.1-11.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=s390x

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • sqlite-debugsource-0:3.26.0-13.el8_4.2.i686 as a component of Red Hat Enterprise Linux BaseOS AUS (v.8.4) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_4.2?arch=i686

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • sqlite-debugsource-0:3.34.1-6.el9_2.3.i686 as a component of Red Hat Enterprise Linux BaseOS E4S (v.9.2) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_2.3?arch=i686

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • sqlite-tcl-debuginfo-0:3.34.1-11.el9_8.aarch64 as a component of Red Hat Enterprise Linux BaseOS (v. 9) · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]_8?arch=aarch64

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • sqlite-analyzer-0:3.53.4-0.1.hum1@x86_64 as a component of Red Hat Hardened Images · fixed

    Vendor assessment for this product only.

    pkg:rpm/redhat/[email protected]?arch=x86_64&distro=hummingbird-20251124&repository_id=public-hummingbird-x86_64-rpms

    • vendor fix: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • registry.redhat.io/rhai/base-image-tpu-rhel9@sha256:41cad25f1fc70729afe2e1bd55100b41414c4695504cc4562403293fdf53551d_amd64 as a component of Red Hat OpenShift AI 3.4 · fixed

    Vendor assessment for this product only.

    pkg:oci/base-image-tpu-rhel9@sha256%3A41cad25f1fc70729afe2e1bd55100b41414c4695504cc4562403293fdf53551d?arch=amd64&repository_url=registry.redhat.io/rhai/base-image-tpu-rhel9&tag=1790703539

    • vendor fix: For more information visit https://access.redhat.com/errata/RHSA-2026:74677 Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • registry.redhat.io/rhui5/rhua-rhel9@sha256:ace80f39f33d921b97be5c74257b52d64170e4eac4b0e2db7d7d13a598d38450_amd64 as a component of Red Hat Update Infrastructure 5 · fixed

    Vendor assessment for this product only.

    pkg:oci/rhua-rhel9@sha256%3Aace80f39f33d921b97be5c74257b52d64170e4eac4b0e2db7d7d13a598d38450?arch=amd64&repository_url=registry.redhat.io/rhui5/rhua-rhel9&tag=1788880581

    • vendor fix: The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility. See the official documentation for more details. Vendor guidance
    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • exploit-intelligence-tech-preview/agent-client-rhel9 as a component of Exploit Intelligence · known affected

    Vendor assessment for this product only.

    pkg:oci/agent-client-rhel9@sha256:ab0ad38061edd3ea804d315eb9c3fb0623c1812071466a580af06f1535df3a37?arch=x86_64&repository_url=quay.io/exploit-intelligence-tech-preview/agent-client-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Affected
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • rhaii/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9@sha256:0c2ac747d67dc0e80162ff05867dd702e474b2217659f19f28b8e3a0c03a942a?arch=x86_64&repository_url=quay.io/rhaii/vllm-tpu-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • rhaiis/vllm-tpu-rhel9 as a component of Red Hat AI Inference Server · known affected

    Vendor assessment for this product only.

    pkg:oci/vllm-tpu-rhel9@sha256:b1c12112a1e8a298645e10d34d44c9961a6121aa8d87fc5d65ad83e1ffa3c586?arch=x86_64&repository_url=quay.io/rhaiis/vllm-tpu-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • sqlite-devel as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/sqlite-devel

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • sqlite-tcl as a component of Red Hat Enterprise Linux 6 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/sqlite-tcl

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Out of support scope
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • rhelai3/bootc-gaudi-rhel9 as a component of Red Hat Enterprise Linux AI (RHEL AI) 3 · known affected

    Vendor assessment for this product only.

    pkg:oci/bootc-gaudi-rhel9@sha256:e1057b59ca1be9501332abf97230855e85c7df858356be0da9dce230ea7e98e1?arch=x86_64&repository_url=quay.io/rhelai3/bootc-gaudi-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-data-science-pipelines-argo-argoexec-rhel9@sha256:ceb3d2e0190fcf6ab5f40907305b6daf763e1915630426928e06db3045308d64?arch=x86_64&repository_url=quay.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Affected
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • rhoai/odh-llm-d-kv-cache-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-llm-d-kv-cache-rhel9@sha256:6228831494c200a94876d7d8027ee5eb87939efc1be9cbdb55b71e0390d5bb44?arch=x86_64&repository_url=quay.io/rhoai/odh-llm-d-kv-cache-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Affected
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • rhoai/odh-ml-pipelines-runtime-generic-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-ml-pipelines-runtime-generic-rhel9@sha256:63e38d012847986e4fecfa845cd041a0545199a270252ddacedf9ae21c130e19?arch=x86_64&repository_url=quay.io/rhoai/odh-ml-pipelines-runtime-generic-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Affected
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • rhoai/odh-rhaii-validator-tools-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-rhaii-validator-tools-rhel9@sha256:7a6efd05e2015e5221078087d5185fa58e51ca978c2aae40442d16ffa540a573?arch=x86_64&repository_url=quay.io/rhoai/odh-rhaii-validator-tools-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Affected
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • rhoai/odh-vllm-gaudi-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known affected

    Vendor assessment for this product only.

    pkg:oci/odh-vllm-gaudi-rhel9@sha256:a71763bda2e2c3a9827771c5a6116f4372fb827f2c7d2324adcd6d6a5eff9d54?arch=x86_64&repository_url=quay.io/rhoai/odh-vllm-gaudi-rhel9

    • workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • no fix planned: Will not fix
    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9@sha256:a5f4c1a5cffdd4a0449fdf9b05815810e92d27601e9d683ed647ee1c2e5df4cf_ppc64le as a component of Cert Manager support for Red Hat OpenShift release 1.20 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/jetstack-cert-manager-acmesolver-rhel9@sha256%3Aa5f4c1a5cffdd4a0449fdf9b05815810e92d27601e9d683ed647ee1c2e5df4cf?arch=ppc64le&repository_url=registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9&tag=1790223630

    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • registry.redhat.io/rhoai/odh-ml-pipelines-runtime-generic-rhel9@sha256:f0628a86188fb9ce5c975cbad6f8c2fdec80255254b4469054b773b56c289768_amd64 as a component of Red Hat OpenShift AI 2.25 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-ml-pipelines-runtime-generic-rhel9@sha256%3Af0628a86188fb9ce5c975cbad6f8c2fdec80255254b4469054b773b56c289768?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-ml-pipelines-runtime-generic-rhel9&tag=1791426501

    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:bad87d9dd54054dced5fae0b3b495598f7e4f719f773a54dfdf35c31b1a93f85_ppc64le as a component of Red Hat OpenShift AI 2.25 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256%3Abad87d9dd54054dced5fae0b3b495598f7e4f719f773a54dfdf35c31b1a93f85?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9&tag=1791869442

    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • registry.redhat.io/rhoai/odh-llm-d-inference-scheduler-rhel9@sha256:53e99ddfe33c7043dd0756af31e1467d7ee7502ec36b279b7cc6e27d30b5004f_arm64 as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-llm-d-inference-scheduler-rhel9@sha256%3A53e99ddfe33c7043dd0756af31e1467d7ee7502ec36b279b7cc6e27d30b5004f?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-llm-d-inference-scheduler-rhel9&tag=1789662430

    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • registry.redhat.io/rhoai/odh-notebook-controller-rhel9@sha256:879d3d19eeab116349bb46583d42bd20092a74669d8f20479d6fc2079e84b207_arm64 as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-notebook-controller-rhel9@sha256%3A879d3d19eeab116349bb46583d42bd20092a74669d8f20479d6fc2079e84b207?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-notebook-controller-rhel9&tag=1790134696

    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • registry.redhat.io/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9@sha256:b93d9d134b3a8fe406e2026c8c0983641c14bada71fda15c183215a444799a2d_ppc64le as a component of Red Hat OpenShift AI 3.3 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-workbench-codeserver-datascience-cpu-py312-rhel9@sha256%3Ab93d9d134b3a8fe406e2026c8c0983641c14bada71fda15c183215a444799a2d?arch=ppc64le&repository_url=registry.redhat.io/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9&tag=1790013905

    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • registry.redhat.io/rhoai/odh-kserve-autogluon-server-rhel9@sha256:d6589bae8df6a36dbdeeadfc5ee027e71d81af34bc128ddb364ad44e01b52460_amd64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-kserve-autogluon-server-rhel9@sha256%3Ad6589bae8df6a36dbdeeadfc5ee027e71d81af34bc128ddb364ad44e01b52460?arch=amd64&repository_url=registry.redhat.io/rhoai/odh-kserve-autogluon-server-rhel9&tag=1791300023

    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • registry.redhat.io/rhoai/odh-mod-arch-gen-ai-rhel9@sha256:bc91daf778c7f4137045c4c37cd704ec6c27da97dd347f581cc0710bc0c136d3_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-mod-arch-gen-ai-rhel9@sha256%3Abc91daf778c7f4137045c4c37cd704ec6c27da97dd347f581cc0710bc0c136d3?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-mod-arch-gen-ai-rhel9&tag=1791861479

    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • registry.redhat.io/rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9@sha256:2698193c61db550eaeb5649c7cf833e2dcd39059905a697439be0a06b157fd1e_arm64 as a component of Red Hat OpenShift AI 3.4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9@sha256%3A2698193c61db550eaeb5649c7cf833e2dcd39059905a697439be0a06b157fd1e?arch=arm64&repository_url=registry.redhat.io/rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9&tag=1791833225

    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00
  • rhoai/odh-notebook-controller-rhel9 as a component of Red Hat OpenShift AI (RHOAI) · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not in execute path

    pkg:oci/odh-notebook-controller-rhel9@sha256:36179d1da580b7e646d52d445a2b893836a2420adb64fbbad27d4d59ff64c903?arch=x86_64&repository_url=quay.io/rhoai/odh-notebook-controller-rhel9

    Red Hat · CVE-2026-11824 · Updated 2026-10-22T19:04:01+00:00

Known Affected Software Configurations

VendorProductVersion range
SqliteSqlite< 3.53.2

All CVSS metrics

  • HIGH 8.5 v4.0 · CNA Primary
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • HIGH 7.8 v3.1 · CNA Primary
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • HIGH 8.5 v4.0 · NVD Secondary
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  • HIGH 7.8 v3.1 · NVD Secondary
    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Patches & mitigations

Advisories

Technical & other

Sources: NVD · CVE.org · All sources and attribution · EPSS